The 'not my fault' position taken by vendors hurts personal and business consumers of software

Microsoft and third party developers have been pointing fingers at each other about who's responsible for URI vulnerabilities. I wonder what would happen if vendors and software developers--from the very small to the very large--would start taking a leadership role in securing electronic processing environments instead of making excuses.

Although Microsoft Corp. fixed four flaws in Internet Explorer (IE) yesterday, it did not address a protocol-handling problem that could trick users into downloading malware, a move that surprised at least one security researcher. The company, however, said it has reopened its investigation and may provide a patch in the future.

"I was prepared to talk about a patch yesterday," said Andrew Storms, director of security operations at nCircle Network Security Inc. "I expected to see Microsoft retract its prior stance and fix this."

Storms was referring to the position that Microsoft first staked out in July -- that Windows and IE are not to blame for the protocol-handling vulnerabilities cited by multiple researchers. This week, the blame game returned when Juergen Schmidt, a researcher at Heiese Security, said IE7 passed invalid Uniform Resource Identifiers (URI) to Windows XP, a bug that attackers could exploit to launch malicious code or scripts if users simply clicked on a link.

When Schmidt asked Microsoft if it intended to patch IE7, he said he received an answer identical to comments the company made last summer: "After its thorough investigation, Microsoft has revealed that this is not a vulnerability in a Microsoft product."

Researchers, including Storms, disagreed. "I still believe they have to do something," he said. "Every application should do its own part to provide security."

In fact, Microsoft may be rethinking the situation. When Computerworld asked the company for comment on Schmidt's claims, it indicated that it had reopened its examination. In an e-mail late Monday, a spokesman said, "Microsoft is aware of reports of a potential issue in the way that Windows handles URLs passed in from other applications. Microsoft is continuing its investigation into this issue. Once we're done investigating, we will take appropriate action to help protect customers. This may include providing an update or additional guidance for customers."

How many investigations will Microsoft have to undertake before it reaches out to engage others in helping to secure customer systems? It appears that Redmond is hiding behind its Legal Department until it can decide on a unilateral solution.

Disclaimer: Blog contents express the viewpoints of their independent authors and
are not reviewed for correctness or accuracy by
Toolbox for IT. Any opinions, comments, solutions or other commentary
expressed by blog authors are not endorsed or recommended by
Toolbox for IT
or any vendor. If you feel a blog entry is inappropriate,
click here to notify
Toolbox for IT.